# FreePBX security-reporting.

Every CVE that names FreePBX security-reporting among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FreePBX: Authenticated API generatedocs Host Command Injection](https://agentprime.io/advisories/CVE-2026-75600.md)
  `CVE-2026-75600` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)](https://agentprime.io/advisories/CVE-2026-54710.md)
  `CVE-2026-54710` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Code injection, CWE-20
- [Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module](https://agentprime.io/advisories/CVE-2026-54708.md)
  `CVE-2026-54708` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal, Code injection
- [FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module](https://agentprime.io/advisories/CVE-2026-54675.md)
  `CVE-2026-54675` · CVE record: FreePBX security-reporting · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Path traversal, Unrestricted file upload
- [Authenticated Command Injection in FreePBX UCP Interface](https://agentprime.io/advisories/CVE-2026-54674.md)
  `CVE-2026-54674` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module](https://agentprime.io/advisories/CVE-2026-45562.md)
  `CVE-2026-45562` · CVE record: FreePBX security-reporting · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module](https://agentprime.io/advisories/CVE-2026-44237.md)
  `CVE-2026-44237` · CVE record: FreePBX security-reporting · CVSS 7.6 High · Not analysed yet · Published 29 May 2026 · Tags: Authentication bypass
- [FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports](https://agentprime.io/advisories/CVE-2026-44238.md)
  `CVE-2026-44238` · CVE record: FreePBX security-reporting · CVSS 8.5 High · Not analysed yet · Published 29 May 2026 · Tags: SQL injection
- [FreePBX: Authenticated Local File Inclusion in Dashboard Module](https://agentprime.io/advisories/CVE-2026-44239.md)
  `CVE-2026-44239` · CVE record: FreePBX security-reporting · CVSS 7.6 High · Not analysed yet · Published 29 May 2026 · Tags: File inclusion
- [FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface](https://agentprime.io/advisories/CVE-2026-46376.md)
  `CVE-2026-46376` · CVE record: FreePBX security-reporting · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Hard-coded credentials
- [Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php](https://agentprime.io/advisories/CVE-2026-26978.md)
  `CVE-2026-26978` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 18 May 2026 · Tags: Insecure deserialization
- [FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints](https://agentprime.io/advisories/CVE-2026-28287.md)
  `CVE-2026-28287` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 5 Mar 2026 · Tags: Command injection
- [FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module](https://agentprime.io/advisories/CVE-2026-28284.md)
  `CVE-2026-28284` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 5 Mar 2026 · Tags: SQL injection
- [FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports](https://agentprime.io/advisories/CVE-2026-28210.md)
  `CVE-2026-28210` · CVE record: FreePBX security-reporting · CVSS 8.6 High · Not analysed yet · Published 5 Mar 2026 · Tags: SQL injection
- [FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration](https://agentprime.io/advisories/CVE-2026-28209.md)
  `CVE-2026-28209` · CVE record: FreePBX security-reporting · CVSS 7.5 High · Not analysed yet · Published 5 Mar 2026 · Tags: Command injection

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=freepbx-security-reporting>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/freepbx-security-reporting/>. Everything for agents: <https://agentprime.io/llms.txt>.